Why residency is a product decision, not a setting
A scan is not anonymous traffic. It records page content, screenshots and sometimes authenticated states of a client site. Once that lands in an evidence pack, it becomes material a procurement team may read years later, so the storage location is part of what we are selling.
We run in the EU only, with no selectable alternative. That closes the transfer question in one sentence instead of an appendix, and it means an agency can answer its own client without asking us first.
Where each thing lives
Every component, its location and whether access is automated or requires a person.
| Component | What it holds | Location | Access |
|---|---|---|---|
| Application | API, workers, scan queue | Falkenstein, DE | automated |
| Database | PostgreSQL, hourly backups | Falkenstein, DE | automated |
| Standby | Warm replica, 15 min RPO | Helsinki, FI | automated |
| Object storage | Screenshots, PDFs, evidence packs | EU region | automated |
| Notifications and reports | EU provider | automated | |
| Error tracking | Stack traces, no page content | EU region | partly automated |
| Payments | Stripe, EU entity, VAT and reverse charge | EU / IE | partly automated |
| Support access | Named staff, ticket-bound, audit logged | EU staff only | manual |
What we store, and for how long
Retention is a compliance feature, not a storage habit: evidence has to outlive the argument it settles, and nothing else should stay longer than it must.
Automated testing covers a subset of accessibility barriers. Manual verification is required for a complete assessment.
How access is controlled
- Every database query is scoped by organisation. A tenant boundary crossing is treated as a defect, not a configuration issue.
- Support access to a workspace is bound to a ticket, limited to named staff, and written to the append-only audit log with actor and duration.
- Impersonation is read-only and always logged. An attempt without a ticket is denied and still recorded.
- The DPA lists every sub-processor with its location and purpose, and version changes are dated so an auditor reads the version that was live.
Questions we get on this
Where is the data stored?
Inside the EU only. Application and database in Falkenstein, standby in Helsinki, EU object storage for screenshots and packs, EU mail provider for notifications.
Can we choose a US region for latency?
No. It is not selectable. The residency question arrives in the first demo of a compliance product, so the answer is fixed by design.
What happens to evidence if we cancel?
Sealed packs stay downloadable for 24 months. Scheduled scans stop at the end of the paid period, never mid-run, and nothing is deleted earlier than the retention setting.